Closed Bug 682168 Opened 13 years ago Closed 13 years ago

TI: "Assertion failure: containsSlot(slot),"

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 680951

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, testcase) 

function f(o) {
    o.valueOf();
    o.__defineSetter__('valueOf', function(){});
}
for (var i = 0; i < 4; i++) {
  f(arguments.__proto__);
}

asserts js debug shell on JM changeset d60ffe67a13f with -m, -a and -n at Assertion failure: containsSlot(slot)
After fixing the v8-deltablue regression caused by bug 680951, this assert showed up in one of the jit-tests so I fixed it in 9a145389d570.  The bug 680951 patch had insufficient filtering for when the slot on an object's native property can be accessed, and would try to get an invalid slot from properties on objects that have a custom setter but no custom getter.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.